Differentiate between CFLAGS and CPPFLAGS.

diff --git a/bin/blhc b/bin/blhc
index 71c97cef5bda0e31a5282160557c2e769898e520..daa0298e6d7a294ae9b1ed69860260bcd4db1389 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -38,15 +38,19 @@ my $cc_regex = qr/(?:[a-z0-9_]+-(?:linux-|kfreebsd-)?gnu(?:eabi|eabihf)?-)?
 my $warning_regex = qr/^(.+?):([0-9]+):[0-9]+: warning: (.+?) \[(.+?)\]$/;
 
 # Regex for source files which require preprocessing.
+my $source_preprocess_compile_cpp_regex = qr/
+    # C++
+      cc | cp | cxx | cpp | CPP | c\+\+ | C
+    # Objective-C++
+    | mm | M
+    /x;
 my $source_preprocess_compile_regex = qr/
     # C
       c
     # Objective-C
     | m
-    # C++
-    | cc | cp | cxx | cpp | CPP | c\+\+ | C
-    # Objective-C++
-    | mm | M
+    # (Objective-)C++
+    | $source_preprocess_compile_cpp_regex
     # Fortran
     | F | FOR | fpp | FPP | FTN | F90 | F95 | F03 | F08
     /x;
@@ -59,15 +63,19 @@ my $source_preprocess_regex = qr/
     | $source_preprocess_no_compile_regex
     /x;
 # Regex for source files which don't require preprocessing.
+my $source_no_preprocess_compile_cpp_regex = qr/
+    # C++
+      ii
+    # Objective-C++
+    | mii
+    /x;
 my $source_no_preprocess_compile_regex = qr/
     # C
       i
-    # C++
-    | ii
+    # (Objective-)C++
+    | $source_no_preprocess_compile_cpp_regex
     # Objective-C
     | mi
-    # Objective-C++
-    | mii
     # Fortran
     | f | for | ftn | f90 | f95 | f03 | f08
     /x;
@@ -111,6 +119,11 @@ my $file_no_compile_regex = qr/
     \.(?: $source_preprocess_no_compile_regex
         | $source_no_preprocess_no_compile_regex)\b
     /x;
+my $file_compile_cpp_regex = qr/
+    $cc_regex.+
+    \.(?: $source_preprocess_compile_cpp_regex
+        | $source_no_preprocess_compile_cpp_regex)\b
+    /x;
 
 # Expected (hardening) flags. All flags are used as regexps.
 my @cflags = (
@@ -132,6 +145,11 @@ my @cflags_stack = (
 my @cflags_pie = (
     '-fPIE',
 );
+my @cxxflags = (
+    '-g',
+    '-O(?:2|3)',
+);
+# @cxxflags_* is the same as @cflags_*.
 my @cppflags = ();
 my @cppflags_fortify = (
     '-D_FORTIFY_SOURCE=2',
@@ -509,17 +527,21 @@ if ($option_arch) {
 # Check the specified hardening options, same order as dpkg-buildflags.
 if ($harden_pie) {
     @cflags  = (@cflags,  @cflags_pie);
+    @cxxflags = (@cxxflags, @cflags_pie);
     @ldflags = (@ldflags, @ldflags_pie);
 }
 if ($harden_stack) {
     @cflags = (@cflags, @cflags_stack);
+    @cxxflags = (@cxxflags, @cflags_stack);
 }
 if ($harden_fortify) {
     @cflags   = (@cflags,   @cflags_fortify);
+    @cxxflags = (@cxxflags, @cflags_fortify);
     @cppflags = (@cppflags, @cppflags_fortify);
 }
 if ($harden_format) {
     @cflags = (@cflags, @cflags_format);
+    @cxxflags = (@cxxflags, @cflags_format);
 }
 if ($harden_relro) {
     @ldflags = (@ldflags, @ldflags_relro);
@@ -580,6 +602,14 @@ for (my $i = 0; $i < scalar @input; $i++) {
         }
     }
 
+    # Assume CXXFLAGS are required when a C++ file is specified in the
+    # compiler line.
+    my $compile_cpp = 0;
+    if ($compile and $line =~ /$file_compile_cpp_regex/) {
+        $compile     = 0;
+        $compile_cpp = 1;
+    }
+
     # Check hardening flags.
     my @missing;
     if ($compile and not all_flags_used($line, \@missing, @cflags)
@@ -587,9 +617,17 @@ for (my $i = 0; $i < scalar @input; $i++) {
             # with -fPIE as well. It's no error if only PIE flags are missing.
             and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie)
             # Assume dpkg-buildflags returns the correct flags.
-            and not $line =~ /`dpkg-buildflags --get (?:CFLAGS|CXXFLAGS)`/) {
+            and not $line =~ /`dpkg-buildflags --get CFLAGS`/) {
         error_flags('CFLAGS missing', \@missing, \%flag_renames, $line);
         $exit |= 1 << 3;
+    } elsif ($compile_cpp and not all_flags_used($line, \@missing, @cflags)
+            # Libraries linked with -fPIC don't have to (and can't) be linked
+            # with -fPIE as well. It's no error if only PIE flags are missing.
+            and not pic_pie_conflict($line, $harden_pie, \@missing, @cflags_pie)
+            # Assume dpkg-buildflags returns the correct flags.
+            and not $line =~ /`dpkg-buildflags --get CXXFLAGS`/) {
+        error_flags('CXXFLAGS missing', \@missing, \%flag_renames, $line);
+        $exit |= 1 << 3;
     }
     if ($preprocess and not all_flags_used($line, \@missing, @cppflags)
             # Assume dpkg-buildflags returns the correct flags.

diff --git a/t/tests.t b/t/tests.t
index 6b23f06d74f586275aebab9c268343d9b6bb44d6..810f6bc2fe77ea08441d93e0349bed8e4ad89ece 100644 (file)
--- a/t/tests.t
+++ b/t/tests.t
@@ -127,7 +127,7 @@ CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -g -O2 -c test-b.c
 CFLAGS missing (-fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): x86_64-linux-gnu-gcc -g -O2 -c test-c.c
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -g -O2 -c test-c.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro): x86_64-linux-gnu-gcc -o test test-a.o test-b.o test-c.o -ltest
-CFLAGS missing (-fPIE): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
+CXXFLAGS missing (-fPIE): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 LDFLAGS missing (-fPIE -pie): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
@@ -180,7 +180,7 @@ CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -g -O2 -c test-b.c
 CFLAGS missing (-fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): x86_64-linux-gnu-gcc -g -O2 -c test-c.c
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -g -O2 -c test-c.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): x86_64-linux-gnu-gcc -o test test-a.o test-b.o test-c.o -ltest
-CFLAGS missing (-fPIE): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
+CXXFLAGS missing (-fPIE): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
@@ -207,7 +207,7 @@ CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -g -O2 -c test-b.c
 CFLAGS missing (-fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): x86_64-linux-gnu-gcc -g -O2 -c test-c.c
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): x86_64-linux-gnu-gcc -g -O2 -c test-c.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): x86_64-linux-gnu-gcc -o test test-a.o test-b.o test-c.o -ltest
-CFLAGS missing (-fPIE): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
+CXXFLAGS missing (-fPIE): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -o ./testProgram ../src/test/testProgram.cpp
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): g++  -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -pthread -Wl,-z,relro -o ../src/test/bin/test ../src/test/objs/test.o
@@ -384,14 +384,14 @@ NONVERBOSE BUILD: Compiling test.cc to ../build/test/test.o
 NONVERBOSE BUILD: Building program ../build/bin/test
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++ -c -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -o ../build/test/test.o test/test.cc
 LDFLAGS missing (-Wl,-z,relro): g++ -fPIC -DPIC \            -o ../build/test/libtest.so.1.2.3 -shared \                       ../build/obj/test/test-a.o ../build/obj/test/test-b.o ../build/obj/test/test-c.o
-CFLAGS missing (-Wformat): g++ -c -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -o ../build/test/test.o test.cc
+CXXFLAGS missing (-Wformat): g++ -c -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -o ../build/test/test.o test.cc
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++ -c -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -o ../build/test/test.o test.cc
 LDFLAGS missing (-Wl,-z,relro): g++ ../build/obj/test/test.o -o /../build/bin/test
 NONVERBOSE BUILD: Compiling test_file.cxx...
-CFLAGS missing (-fstack-protector): g++ -g -O2 -fPIC --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test_file.cxx
+CXXFLAGS missing (-fstack-protector): g++ -g -O2 -fPIC --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test_file.cxx
 NONVERBOSE BUILD: [ 22%] Building CXX object src/CMakeFiles/test/test.cpp.o
 NONVERBOSE BUILD: [ 82%] Building C object src/CMakeFiles/test/test.c.o
-CFLAGS missing (-Wformat): cd /tmp/test/src && /usr/bin/c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -o CMakeFiles/test-verbose.dir/verbose.cpp.o -c -D_FORTIFY_SOURCE=2 /tmp/test/src/test-verbose/verbose.cpp
+CXXFLAGS missing (-Wformat): cd /tmp/test/src && /usr/bin/c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -o CMakeFiles/test-verbose.dir/verbose.cpp.o -c -D_FORTIFY_SOURCE=2 /tmp/test/src/test-verbose/verbose.cpp
 CFLAGS missing (-Werror=format-security): cd /tmp/test/src && /usr/bin/gcc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -o CMakeFiles/test-verbose-c.dir/verbose-c.c.o -c -D_FORTIFY_SOURCE=2 /tmp/test/src/test-verbose-c/verbose-c.c
 ';
 
@@ -411,12 +411,12 @@ is_blhc 'make', '', 1,
 # cc
 
 is_blhc 'cc', '--pie --bindnow', 8,
-        'CFLAGS missing (-fPIE -Wformat): cc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cc
+        'CXXFLAGS missing (-fPIE -Wformat): cc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cc
 CFLAGS missing (-fPIE -Wformat): cc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.c
 CFLAGS missing (-fPIE --param=ssp-buffer-size=4): cc -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.c
 CFLAGS missing (-fPIE -Werror=format-security): cc -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): cc -Wl,-z,defs -o test test-a.o test-b.o test-c.o -ltest
-CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): cc\     test.cc
+CXXFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): cc\     test.cc
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): cc\     test.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): cc\     test.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): cc -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
@@ -426,7 +426,7 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,now): cc -Wl,-z,defs test-a.o test-b.o test-c
 # gcc
 
 is_blhc 'gcc', '--pie --bindnow', 8,
-        'CFLAGS missing (-fPIE -Wformat): gcc-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cc
+        'CXXFLAGS missing (-fPIE -Wformat): gcc-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cc
 CFLAGS missing (-fPIE -Wformat): gcc-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.c
 CFLAGS missing (-fPIE --param=ssp-buffer-size=4): gcc-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.c
 CFLAGS missing (-fPIE -Werror=format-security): gcc-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.c
@@ -441,10 +441,10 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,now): gcc-4.6 -Wl,-z,defs test-a.o test-b.o t
 # c++
 
 is_blhc 'c++', '--pie --bindnow', 8,
-        'CFLAGS missing (-fPIE -Wformat): c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
-CFLAGS missing (-fPIE --param=ssp-buffer-size=4): c++ -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
-CFLAGS missing (-fPIE -Werror=format-security): c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
-CFLAGS missing (-fPIE): c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
+        'CXXFLAGS missing (-fPIE -Wformat): c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
+CXXFLAGS missing (-fPIE --param=ssp-buffer-size=4): c++ -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
+CXXFLAGS missing (-fPIE -Werror=format-security): c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
+CXXFLAGS missing (-fPIE): c++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): c++ -Wl,-z,defs -o test test-a.o test-b.o test-c.o test-d.o -ltest
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): c++ -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
 CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): c++\     test.c
@@ -453,10 +453,10 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): c++\     test.c
 CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): c++\     test.c++
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): c++\     test.c++
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): c++\     test.c++
-CFLAGS missing (-fPIE -Wformat): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
-CFLAGS missing (-fPIE --param=ssp-buffer-size=4): c++-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
-CFLAGS missing (-fPIE -Werror=format-security): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
-CFLAGS missing (-fPIE): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
+CXXFLAGS missing (-fPIE -Wformat): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
+CXXFLAGS missing (-fPIE --param=ssp-buffer-size=4): c++-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
+CXXFLAGS missing (-fPIE -Werror=format-security): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
+CXXFLAGS missing (-fPIE): c++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): c++-4.6 -Wl,-z,defs -o test test-a.o test-b.o test-c.o test-d.o -ltest
 ';
 
@@ -464,24 +464,24 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): c++-4.6 -Wl,-z,defs -o tes
 # g++
 
 is_blhc 'g++', '--pie --bindnow', 8,
-        'CFLAGS missing (-fPIE -Wformat): g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
-CFLAGS missing (-fPIE --param=ssp-buffer-size=4): g++ -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
-CFLAGS missing (-fPIE -Werror=format-security): g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
-CFLAGS missing (-fPIE): g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
+        'CXXFLAGS missing (-fPIE -Wformat): g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
+CXXFLAGS missing (-fPIE --param=ssp-buffer-size=4): g++ -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
+CXXFLAGS missing (-fPIE -Werror=format-security): g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
+CXXFLAGS missing (-fPIE): g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++ -Wl,-z,defs -o test test-a.o test-b.o test-c.o test-d.o -ltest
-CFLAGS missing (-fPIE -Wformat): x86_64-linux-gnu-g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
-CFLAGS missing (-fPIE --param=ssp-buffer-size=4): x86_64-linux-gnu-g++ -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
-CFLAGS missing (-fPIE -Werror=format-security): x86_64-linux-gnu-g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
-CFLAGS missing (-fPIE): x86_64-linux-gnu-g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
+CXXFLAGS missing (-fPIE -Wformat): x86_64-linux-gnu-g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
+CXXFLAGS missing (-fPIE --param=ssp-buffer-size=4): x86_64-linux-gnu-g++ -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
+CXXFLAGS missing (-fPIE -Werror=format-security): x86_64-linux-gnu-g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
+CXXFLAGS missing (-fPIE): x86_64-linux-gnu-g++ -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): x86_64-linux-gnu-g++ -Wl,-z,defs -o test test-a.o test-b.o test-c.o test-d.o -ltest
 LDFLAGS missing (-fPIE -pie -Wl,-z,now): g++ -Wl,-z,defs test-a.o test-b.o test-c.o -ltest -Wl,-z,relro -o test/test-4.2~_4711/test.so test.o
 CFLAGS missing (-g -O2 -fPIE -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security): g++\     test.c
 CPPFLAGS missing (-D_FORTIFY_SOURCE=2): g++\     test.c
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++\     test.c
-CFLAGS missing (-fPIE -Wformat): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
-CFLAGS missing (-fPIE --param=ssp-buffer-size=4): g++-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
-CFLAGS missing (-fPIE -Werror=format-security): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
-CFLAGS missing (-fPIE): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
+CXXFLAGS missing (-fPIE -Wformat): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-a.cpp
+CXXFLAGS missing (-fPIE --param=ssp-buffer-size=4): g++-4.6 -g -O2 -fstack-protector -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-b.cpp
+CXXFLAGS missing (-fPIE -Werror=format-security): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -c test-c.cpp
+CXXFLAGS missing (-fPIE): g++-4.6 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2 -c test-d.cc
 LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++-4.6 -Wl,-z,defs -o test test-a.o test-b.o test-c.o test-d.o -ltest
 ';
 
@@ -490,7 +490,7 @@ LDFLAGS missing (-fPIE -pie -Wl,-z,relro -Wl,-z,now): g++-4.6 -Wl,-z,defs -o tes
 
 is_blhc 'libtool', '--bindnow', 8,
         'CFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CC   --mode=compile x86_64-linux-gnu-gcc -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
-CFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CC   --mode=compile x86_64-linux-gnu-g++ -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.cpp
+CXXFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CC   --mode=compile x86_64-linux-gnu-g++ -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.cpp
 CFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CC   --mode=compile gcc-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
 CFLAGS missing (-fPIE -Wformat): /bin/bash ../../libtool --tag=CXX  --mode=compile g++-4.6 -D_FORTIFY_SOURCE=2 -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat-security -Werror=format-security -c test.c
 LDFLAGS missing (-fPIE): libtool: link: g++ -shared test-a.o test-b.o test-b.o test-c.o -O2 -pie -Wl,relro -Wl,now -o test.so